Security Engineer

TyneStack Ltd; Newcastle upon Tyne; Hybrid; GBP 65,000 - 90,000; Full time

Benefits offered by this job

Hybrid work pattern

Collaborative security culture

Opportunity to influence DevSecOps

Job summary

TyneStack Ltd is seeking an Application Security Engineer to embed security across a substantial .NET/Azure environment. You will partner with developers and security specialists to identify vulnerabilities, improve secure coding, and ensure security is designed into enterprise applications.

The role emphasises hands-on security assessments, threat modelling, and integrating security into Azure DevOps CI/CD pipelines, with a focus on DevSecOps maturity and secure architecture reviews.

Qualifications

• Experience securing apps in Microsoft Azure.
• Strong knowledge of OWASP principles and Top 10.
• Experience with .NET stack, including C# and APIs.
• Experience with SAST, DAST and software composition analysis tools.
• Knowledge of authentication/identity tech (OAuth2, OpenID Connect, Entra ID).

Responsibilities

• Embed security controls across the SDLC.
• Conduct secure design reviews for .NET apps, APIs and cloud services.
• Perform SAST/DAST and SCA testing.
• Identify and remediate vulnerabilities.
• Integrate security tooling into Azure DevOps CI/CD pipelines.
• Define secure coding standards aligned with OWASP.
• Conduct threat modelling and security assessments.
• Review Azure configurations and identity management.
• Improve application security monitoring with Defender/Sentinel.
• Collaborate with dev teams to improve DevSecOps maturity.

Skills

Azure security

OWASP Top 10

C# / .NET

SAST/DAST

DevSecOps

Azure DevOps

Threat modelling

Azure Key Vault

Microsoft Defender

Security monitoring

APIs security

CI/CD pipelines

Tools

SonarQube

Tenable

Job description

Application Security Engineer (.NET / Azure / DevSecOps)

Location: Newcastle upon Tyne | Hybrid (3 Days Office / 2 Days Home)

Salary: Competitive, depending on experience

Type: Full-time, Permanent

Overview

An established UK financial services organisation is looking to appoint an Application Security Engineer to join its Cyber Security function.

This is a hands-on technical security role focused on embedding security throughout the software development lifecycle across a substantial Microsoft Azure and .NET application environment.

You’ll work closely with software developers, engineering teams and security specialists to identify vulnerabilities, improve secure coding practices and ensure applications are designed, developed and maintained with security at their core.

The position would particularly suit someone with a strong application security background who enjoys working directly with development teams, understands modern software engineering practices and wants to influence how security is implemented across enterprise applications.

Key Responsibilities

• Embed application security controls throughout the software development lifecycle
• Conduct secure design reviews across .NET applications, APIs and cloud services
• Perform static and dynamic application security testing (SAST and DAST) and software composition analysis (SCA)
• Identify, assess and support remediation of application vulnerabilities
• Integrate security tooling and automated checks into Azure DevOps CI/CD pipelines
• Define and improve secure coding standards aligned with OWASP best practices
• Conduct threat modelling and security assessments for critical applications
• Review Azure security configurations, including identity management and Azure Key Vault
• Develop and improve application security monitoring using Microsoft Defender and Sentinel
• Work with development teams to improve secure coding practices, vulnerability management and DevSecOps maturity

Requirements

• Commercial experience securing applications hosted within Microsoft Azure
• Strong understanding of application security principles and OWASP Top 10 vulnerabilities
• Experience working with .NET technologies, including C#, ASP.NET and APIs
• Experience with SAST, DAST and software composition analysis tools
• Understanding of Azure DevOps, CI/CD pipelines and security automation
• Knowledge of authentication and identity technologies, including OAuth2, OpenID Connect and Microsoft Entra ID
• Experience identifying, assessing and remediating application vulnerabilities
• Strong communication skills and the ability to work closely with software engineering teams
• Experience with SonarQube or Tenable
• Experience within financial services or another regulated environment
• Experience with Microsoft Defender and Microsoft Sentinel
• Experience conducting application threat modelling and secure architecture reviews
• Experience supporting security incident response and DevSecOps improvement initiatives

What's on Offer

• Competitive salary depending on experience
• Hybrid working with three days per week in Newcastle
• Opportunity to work across a substantial Azure and .NET application environment
• Direct involvement in improving application security and secure development practices
• Collaboration with experienced software development and cyber security teams
• Opportunity to influence security standards, automation and DevSecOps maturity